CVE-2026-2718

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2718", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-18T21:01:51.626Z", "datePublished": "2026-02-19T09:26:36.089Z", "dateUpdated": "2026-04-08T16:56:49.636Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:49.636Z"}, "affected": [{"vendor": "dealia", "product": "Dealia \u2013 Request a quote", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Dealia \u2013 Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and including, 1.0.8. This is due to the use of `wp_kses()` for output escaping within HTML attribute contexts where `esc_attr()` is required. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Dealia <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/617785d7-90b1-482c-bfff-9b5a63741415?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/templates/widgets/dealia-nonproduct-button.php#L7"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/templates/widgets/dealia-nonproduct-button.php#L7"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/functions.php#L9"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/functions.php#L9"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ronnachai Sretawat Na Ayutaya"}], "timeline": [{"time": "2026-02-18T21:07:11.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T20:38:35.399621Z", "id": "CVE-2026-2718", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T20:38:49.824Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2718", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T20:38:35.399621Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T20:38:42.553Z"}}], "cna": {"title": "Dealia <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Ronnachai Sretawat Na Ayutaya"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "dealia", "product": "Dealia \u2013 Request a quote", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T21:07:11.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/617785d7-90b1-482c-bfff-9b5a63741415?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/templates/widgets/dealia-nonproduct-button.php#L7"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/templates/widgets/dealia-nonproduct-button.php#L7"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/functions.php#L9"}, {"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/functions.php#L9"}], "descriptions": [{"lang": "en", "value": "The Dealia \u2013 Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and including, 1.0.6. This is due to the use of `wp_kses()` for output escaping within HTML attribute contexts where `esc_attr()` is required. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-19T09:26:36.089Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2718", "state": "PUBLISHED", "dateUpdated": "2026-02-20T20:38:49.824Z", "dateReserved": "2026-02-18T21:01:51.626Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T09:26:36.089Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Dealia \u2013 Request a quote", "vendor": "dealia", "versions": [{"lessThanOrEqual": "1.0.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Dealia \u2013 Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and including, 1.0.8. This is due to the use of `wp_kses()` for output escaping within HTML attribute contexts where `esc_attr()` is required. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Dealia \u2013 Request a Quote para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de atributos de bloque de Gutenberg en todas las versiones hasta la 1.0.6, inclusive. Esto se debe al uso de 'wp_kses()' para el escape de salida dentro de contextos de atributos HTML donde se requiere 'esc_attr()'. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-2718", "lastModified": "2026-06-17T10:31:35.907", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2718", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T20:38:35.399621Z", "version": "2.0.3"}}]}, "published": "2026-02-19T10:16:12.400", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/functions.php#L9"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/templates/widgets/dealia-nonproduct-button.php#L7"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/functions.php#L9"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/templates/widgets/dealia-nonproduct-button.php#L7"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/617785d7-90b1-482c-bfff-9b5a63741415?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Dealia \u2013 Request a quote", "source": "cna", "vendor": "dealia"}, "product": "dealia_\u2013_request_a_quote", "vendor": "dealia"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:08:19.388448+00:00", "value": {"mitigation_remediation": ["Upgrade Dealia plugin to a version that properly sanitizes block attributes, or apply the vendor patch if provided.", "If an upgrade is not immediately possible, restrict Contributor role permissions on the site or remove the Contributor capability from users who do not require direct content editing, thereby limiting the scope of the attacker.", "As a developer, audit Gutenberg block templates to ensure that any attribute output uses esc_attr instead of wp_kses, or apply a custom filter to correct the escaping for existing content."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All versions of the Dealia \u2013 Request a Quote plugin up to and including 1.0.8 are affected. The vulnerability requires a user with at least Contributor privileges on a WordPress site that hosts the plugin. No specific operating system or server configuration is mentioned.", "description_and_impact": "The vulnerability arises from the Dealia \u2013 Request a Quote WordPress plugin improperly escaping user\u2011supplied data in Gutenberg block attributes. The code uses wp_kses when an attribute context requires esc_attr, allowing malicious scripts to be embedded and stored in the page content. An authenticated user with Contributor level or higher can inject these scripts, which execute in the browsers of any visitor to the affected page, potentially leading to session hijacking, defacement, or other client\u2011side attacks.", "risk_and_exploitability": "With a CVSS score of 6.4, the vulnerability is considered moderate risk. The EPSS score is below 1\u202f%, indicating a low likelihood of exploitation under current conditions, and it is not listed in CISA\u2019s KEV catalog. The attack vector is web\u2011based and relies on authenticated access, meaning it only affects sites where an attacker has gained Contributor or higher permissions. The stored nature of the flaw means the malicious script remains in the content until removed or the plugin is fixed, allowing repeated exploitation of any user who loads the affected page."}}}}, "created": "2026-02-20T10:07:45.112652+00:00", "updated": "2026-04-15T18:15:10.833606+00:00", "vendors": ["dealia", "dealia$PRODUCT$dealia_\u2013_request_a_quote", "wordpress", "wordpress$PRODUCT$wordpress"]}